Skip to main content

Hashicorp Vault

The goal of this guide is to configure Signatory to use an Hashicorp Vault as a signing backend.

Vault setup

Run Vault server or use dedicated cloud instance (HCP Vault) for secrets management

Install vault

Run Dev Server

docker run --cap-add=IPC_LOCK -d --name=dev-vault vault

Configure Vault Address and Token

Set the Vault address and obtain the root token provided when starting the Vault server.

export VAULT_ADDR=
export VAULT_TOKEN={{root_token}}

Enable Transit Secrets Engine

Enable the Transit secrets engine which is used to manage cryptographic functions.

vault secrets enable transit

Create Transit Key

Create a new encryption key in the transit secrets engine.

vault write -f transit/keys/{{my-key}} type="ed25519"

Create Policy for Transit

Create a policy that allows reading and writing keys in the transit engine.

# transit-policy.hcl
path "transit/*" {
capabilities = ["read", "create", "update", "list"]

Create AppRole Authentication

Enable and configure the AppRole authentication method.

vault auth enable approle

Create AppRole Role

Create a role for the AppRole authentication method. This role associates a set of policies with the AppRole.

vault write auth/approle/role/my-approle \
secret_id_ttl=0m \
token_ttl=20m \
token_max_ttl=30m \

Fetch Role ID and Secret ID

Fetch the Role ID and Secret ID of the AppRole.

vault read auth/approle/role/{{my-approle}}/role-id
vault write -f auth/approle/role/{{my-approle}}/secret-id

Backend configuration

Configuration parameters

addressURLVault URL
roleIDUUIDAppRole identifier
secretIDUUIDAppRole credential
transitConfig.mountPointstringPath to the transit secret engine
tlsCaCertstringOPTIONALtlsCaCert is the path to a PEM-encoded CA cert file to use to verify the Vault server SSL certificate.
tlsClientCertstringOPTIONALtlsClientCert is the path to the certificate for Vault communication
tlsClientKeystringOPTIONALtlsClientKey is the path to the private key for Vault communication


address: ""
roleID: "5970e31e-132b-d624-f3eb-10d1fcdd3fab"
secretID: "aa9c4a24-c7f1-a278-a9db-bac58273fe7c"
mountPoint: "transit/"